[Bug 1949115] Re: default install of focal allows privilege escalation via lxd group

[Seth Arnold]

Yeah; I thought we had a list of 'root-equivalent groups' around here
somewhere, but last time I went looking for that list, I couldn't find
it. Does it already exist? If not, we should probably write one.

Thanks

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to user-setup in Ubuntu.
https://bugs.launchpad.net/bugs/1949115

Title:
  default install of focal allows privilege escalation via lxd group

Status in user-setup package in Ubuntu:
  New

Bug description:
  By default, a new installation of Ubuntu (at least I tried 20.04
  Desktop, but I assume this applies to other variants/versions as well)
  create a user which is in the lxd group. When the lxd snap is also
  installed, this user can now create privileged containers which
  essentially allow trivial privilege elevation to root.

  This might be a bug in lxd with privileged container creation
  requiring full root, or it might be the case that the default user
  should not be put into the lxd group out of the box, so I'm not sure
  what's the best package to file this one against.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/user-setup/+bug/1949115/+subscriptions